Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I may have some kind of infection


  • This topic is locked This topic is locked
2 replies to this topic

#1 Fandard

Fandard

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:24 AM

Posted 19 November 2010 - 12:05 AM

I don't know if I have some infection or not on my computer.

I have installed on program that is called "Curse Client". This program connects to the internet when it starts. Since two days ago that is no longer happening. When I checked the logs of that program I noticed that in the Internet connection entry it has some stuff that should not be there and that it might indicate some kind of infection.

This is what I get there:

[2010-11-19 03:36:37 Error] Task 'Connection' returned an invalid response: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>DNS Made Easy: Domain Does Not Exist</title>
<style type="text/css">
<!--
body {
background-color: #ffffff;
background-image: url(http://208.94.147.150/expiredbg.png);
background-repeat: repeat-x;
}
-->
</style>
</head>
<body>
<center>
<a href="http://www.dnsmadeeasy.com"><img src="http://208.94.147.150/dnsmelogo.png" alt="DNS Made
Easy" border=0></a>

<p>
<h4>You are seeing this page because the current domain is not configured in the current set of name servers or your domain is being
parked.<b
r>
This is usually just a temporary error while the domain is being added. Once the domain is configured this page will expire and your
correct site will be shown. <br>
<br>
If your system administrator is having you use the wrong resolving name servers you will want to notify them of this mistake
right away.<br>
If you are looking for free resolving name servers (for desktop and personal computers) we suggest you use the free service at <a
href="http://www.resolvin
gnameserver.com/freerns.html" target="_blank">Resolving Name Server</a>.<br>
</h4>
</p>
<p></p>
<iframe src="http://searchportal.information.com/?o_id=108176&domainname=referer_detect" width="100%" height="700px" frameborder=0 marginwidth="0px" marginheight="0px" scrolling="no">
<p>Unfortunately, your browser doesn't support iframes. Please click <a href="http://searchportal.information.com/?o_id=108176&domainname=referer_detect">here</a> to be directed to a page by our sponsors.</p>
</iframe>
<p><font size=-2>ResolvingNameServer.com provided as a free service by <a href="http://www.dnsmadeeasy.com">DNS Made Easy</a>, the world leader in
Enterprise DNS Service.</p>
<center>
<a href="http://www.dnsmadeeasy.com"><img src="http://208.94.147.150/dnsmelogo.png" alt="DNS Made
Easy" border=0></a>
</body>
</html>

[2010-11-19 03:36:37 Info] Task 'Connection' failed



Any help with this will be appreciated.



This is the content of the DDS.txt file:



DDS (Ver_10-11-10.01) - NTFSx86
Run by Francisco_2 at 1:23:01,53 on 19/11/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.54.1033.18.2046.543 [GMT -3:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Wuala Dokan\mounter.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
C:\Windows\system32\nvvsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\CtHelper.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Users\Francisco_2\AppData\Roaming\Wuala\Wuala.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\FreeCommander\FreeCommander.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Francisco_2\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Francisco_2\Desktop\Defogger.exe
C:\Windows\system32\conhost.exe
C:\Users\Francisco_2\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files

\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:

\progra~1\micros~4\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin

\jp2ssv.dll
uRun: [Google Update] "c:\users\francisco_2\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [CTHelper] CTHELPER.EXE
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
mRun: [<NO NAME>]
mRun: [HPUsageTracking] c:\program files\hp\hp ut\bin\hppusg.exe "c:\program files\hp\hp ut\"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
dRun: [CtxfiReg] CTXFIREG.exe /FAIL1
dRun: [DevconDefaultDB] c:\windows\system32\READREG /SILENT /FAIL=1
StartupFolder: c:\users\francisco_2\appdata\roaming\microsoft\windows\start menu\programs\startup

\CurseClientStartup.ccip
StartupFolder: c:\users\franci~2\appdata\roaming\micros~1\windows\startm~1\programs\startup\wuala.lnk - c:\users

\francisco_2\appdata\roaming\wuala\Wuala.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft

office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft

office\office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:

\progra~1\spybot~1\SDHelper.dll
DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} -

hxxps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: {4C4C594D-3E40-4FD5-83B5-0A278A154F41} = 38.119.98.220,216.93.191.228
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared

\office14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:

\progra~1\micros~4\office14\GROOVEEX.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-

0016-0000-0022-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 wDokan;wDokan;c:\windows\system32\drivers\wdokan.sys [2010-8-11 72568]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2009-6-23 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2009-6-23 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2009-6-23 566296]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-3-25 42368]
R3 VMHybrid;VMHybrid service;c:\windows\system32\drivers\VMHybrid.sys [2010-5-19 1104768]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13

229888]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2009-6-23 99352]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2009-6-23 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2009-6-23 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2009-6-23 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2009-6-23 566296]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2010-9-13 645120]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\drivers\Ph3xIB32.sys [2009-6-10 1311232]

=============== Created Last 30 ================

2010-11-19 03:44:10 6273872 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates

\{fd077e14-f3a1-400c-9bea-b8edaf4e0251}\mpengine.dll
2010-11-19 02:55:29 -------- d-----w- c:\program files\Speccy
2010-11-19 02:45:50 -------- d-----w- c:\program files\CCleaner
2010-11-19 02:24:09 388096 ----a-r- c:\users\franci~2\appdata\roaming\microsoft\installer\{45a66726-

69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2010-11-19 02:24:05 -------- d-----w- c:\program files\Trend Micro
2010-11-19 01:59:52 240008 ----a-w- c:\windows\system32\drivers\netio.sys
2010-11-19 01:59:18 1238528 ----a-w- c:\windows\system32\zpeng25.dll
2010-11-19 01:58:54 461400 ----a-w- c:\windows\system32\drivers\vsdatant.sys
2010-11-19 01:58:54 -------- d-----w- c:\windows\system32\ZoneLabs
2010-11-19 01:58:51 -------- d-----w- c:\program files\Zone Labs
2010-11-19 01:57:42 -------- d-----w- c:\progra~2\CheckPoint
2010-11-19 01:57:33 -------- d-----w- c:\windows\Internet Logs
2010-11-17 00:43:44 -------- d-----w- c:\users\franci~2\appdata\local\ElevatedDiagnostics
2010-11-16 02:10:41 119808 ----a-r- c:\users\franci~2\appdata\roaming\microsoft\installer\{ccf298af-

9ce1-4b26-b251-486e98a34789}\icons.exe
2010-11-14 05:23:57 -------- d-----w- c:\users\franci~2\appdata\roaming\Foxit Software
2010-11-14 04:25:47 -------- d-----w- c:\program files\Wuala Dokan
2010-11-14 04:25:45 -------- d-----w- c:\users\franci~2\appdata\roaming\Wuala
2010-11-14 04:25:45 -------- d-----w- c:\users\franci~2\appdata\local\Wuala
2010-11-03 05:04:27 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2010-11-03 04:57:58 15256 ----a-w- c:\users\franci~2\appdata\roaming\microsoft\identitycrl\production

\ppcrlconfig.dll
2010-11-03 04:53:38 -------- d-----w- c:\windows\system32\xlive
2010-11-03 04:53:37 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-11-03 04:43:59 440080 ----a-w- c:\windows\system32\d3dx10.dll
2010-11-03 00:07:17 -------- d-----w- c:\program files\common files\Steam
2010-11-03 00:07:15 -------- d-----w- c:\program files\Steam
2010-10-30 17:44:02 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2010-10-27 15:49:55 -------- d-----w- c:\program files\Microsoft Synchronization Services
2010-10-27 15:49:08 -------- d-----w- c:\windows\PCHEALTH
2010-10-27 15:49:08 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-10-27 15:47:09 -------- d-----w- C:\IDE
2010-10-27 15:46:54 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-10-27 15:45:23 -------- d-----w- c:\program files\Microsoft Analysis Services
2010-10-27 00:40:00 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-10-27 00:40:00 417792 ----a-w- c:\windows\system32\msdri.dll
2010-10-27 00:40:00 204288 ----a-w- c:\windows\system32\MSNP.ax
2010-10-27 00:40:00 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2010-10-27 00:14:18 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

==================== Find3M ====================

2010-10-19 20:51:33 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-14 04:36:52 15451288 ----a-w- c:\windows\system32\xlive.dll
2010-10-14 04:36:50 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2010-09-15 07:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-08 04:30:04 978432 ----a-w- c:\windows\system32\wininet.dll
2010-09-08 04:28:15 44544 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-08 03:22:31 386048 ----a-w- c:\windows\system32\html.iec
2010-09-08 02:48:16 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-09-01 04:23:49 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2010-09-01 02:34:52 2327552 ----a-w- c:\windows\system32\win32k.sys
2010-08-31 04:32:30 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-08-31 04:32:30 954288 ----a-w- c:\windows\system32\mfc40u.dll
2010-08-27 05:46:48 168448 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 04:39:58 109056 ----a-w- c:\windows\system32\t2embed.dll
2010-08-23 01:26:14 64000 ----a-w- c:\windows\system32\E_FBCB9BL.DLL
2010-08-23 01:26:07 79654 ----a-w- c:\windows\system32\E_FLM9BL.DLL
2010-08-23 01:26:03 34304 ----a-w- c:\windows\system32\E_FBCH9BL.DLL
2010-08-23 01:25:56 309248 ----a-w- c:\windows\system32\EAL32.DLL
2010-08-23 01:25:53 82944 ----a-w- c:\windows\system32\EAL.EXE
2010-08-21 05:36:33 738816 ----a-w- c:\windows\system32\wmpmde.dll
2010-08-21 05:36:24 224256 ----a-w- c:\windows\system32\schannel.dll
2010-08-21 05:33:24 530432 ----a-w- c:\windows\system32\comctl32.dll
2010-08-21 05:32:37 316928 ----a-w- c:\windows\system32\spoolsv.exe

============= FINISH: 1:25:41,23 ===============


Thank you in advance!

Attached Files



BC AdBot (Login to Remove)

 


#2 Casey_boy

Casey_boy

    Bleeping physicist


  • Malware Response Team
  • 7,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:08:24 AM

Posted 28 November 2010 - 01:29 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


Casey

If I have been helping you and I do not reply within 48hours, feel free to send me a PM.


* My Website * Am I Infected? * Malware Removal Help * If you'd like to say thanks *


#3 SpySentinel

SpySentinel

  • Staff Emeritus
  • 2,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The United States
  • Local time:03:24 AM

Posted 03 December 2010 - 10:52 AM

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please send me a PM.

This applies only to the original topic starter. Everyone else please begin a New Topic.
Posted Image
Unified Network of Instructors and Trained Eliminators

Posted Image

My help is always free, but if you can, please Posted Image to help me continue the fight against malware.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users